Kleor vulnerabilities
5 vulnerabilities
Known vulnerabilities in Kleor products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 2 products.
Products
2- Contact Manager4 vulnerabilities
- Easy Timer1 vulnerabilities
CriticalCVE-2026-109218kleor · contact managerContact Manager <= 9.1.2 - Unauthenticated Arbitrary File Upload via Trailing-Dot Filename Blacklist BypassThe Contact Manager plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 9.1.2 via the add_message function. This is due to an incomplete extension blacklist that fails to detect dangerous extensions when a trailing dot causes the extension-derivation routine to return an empty string, which sanitize_file_name() then silently removes before the file is written to disk. This makes it possible for unauthenticated attackers to upload files that may be executable, which makes remote code execution possible. Successful code execution additionally requires the server to use Apache with libapache2-mod-php (which maps .phar to PHP by default) and the attacker to retrieve the uploaded file within the brief window before it is removed by unlink() at end of request.HighCVE-2025-1028kleor · contact manager +1 moreContact Manager <= 8.6.4 - Unauthenticated Arbitrary Double File Extension UploadThe Contact Manager plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the contact form upload feature in all versions up to, and including, 8.6.4. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible in specific configurations where the first extension is processed over the final. This vulnerability also requires successfully exploiting a race condition in order to exploit.EPSS0.76%HighCVE-2025-68853kleor · contact manager +1 moreWordPress Contact Manager plugin <= 9.1.1 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in Kleor Contact Manager contact-manager allows Object Injection.This issue affects Contact Manager: from n/a through <= 9.1.1.EPSS0.43%HighCVE-2025-9519kleor · easy timer +1 moreEasy Timer <= 4.2.1 - Authenticated (Editor+) Remote Code Execution via ShortcodeThe Easy Timer plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 4.2.1 via the plugin's shortcodes. This is due to insufficient restriction of shortcode attributes. This makes it possible for authenticated attackers, with Editor-level access and above, to execute code on the server.EPSS0.91%MediumCVE-2025-8783kleor · contact manager +1 moreContact Manager <= 8.6.5 - Authenticated (Administrator+) Stored Cross-Site Scripting via 'title'The Contact Manager plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'title’ parameter in all versions up to, and including, 8.6.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.EPSS0.30%HighCVE-2026-32517kleor · contact manager +1 moreWordPress Contact Manager plugin <= 9.1 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kleor Contact Manager contact-manager allows Reflected XSS.This issue affects Contact Manager: from n/a through <= 9.1.EPSS0.18%